Threat Investigation
Request a demo

CVE-2024-50688

Critical

Description

SunGrow iSolarCloud Android application V2.1.6.20241017 and prior contains hardcoded credentials. The application (regardless of the user account) and the cloud uses the same MQTT credentials for exchanging the device telemetry.

SeverityCritical
CVSS9.8
Exploit probability—
ProductSungrowpower Isolarcloud
PublishedFeb 26, 2025
First seenFeb 26, 2025
Weakness typeCWE-798Hard-coded credentials

How to fix

Update
  • sungrowpower isolarcloud2.1.6.20241104 or later

Affected products

ProductAffected versionsFixed in
sungrowpower isolarcloudv < 2.1.6.202411042.1.6.20241104

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.